Graph-Calibrated Differential Privacy for Correlated IoT Sensing Streams

Abstract

Internet of Things (IoT) streams contain temporal, spatial, and cross-channel dependencies that can support inference about an attribute even after a formally private release. Standard differential privacy does not assume statistical independence; its guarantee is relative to a declared neighboring relation and may protect a narrower unit than the secret of practical interest. This paper proposes Graph-Calibrated Differential Privacy (GC-DP), which uses a lag-aware component graph to rank empirical exposure, construct conservative component scores, and allocate a release budget. The formal mechanism fixes a graph-expanded input adjacency independently of the protected data and calibrates each released coordinate to a certified global sensitivity bound. The graph, threshold, empirical-influence scores, and utility scores are obtained from public calibration information or through an explicitly composed private-calibration budget. For the latter case, the paper specifies a bounded-vector Laplace calibration mechanism and separates its budget from the release budget. Experiments on four public IoT datasets evaluate downstream utility, attribute-inference performance, ablations, and computational cost. All reported values are empirical measurements averaged over ten independent noise draws. Under the evaluated component-occurrence adjacency and public-calibration protocol, GC-DP achieves higher task utility and lower attribute-inference performance than the included uniform and partially adaptive baselines across the tested privacy budgets.

1. Introduction

Internet of Things (IoT) infrastructures continuously collect fine-grained sensing streams from smartphones, wearables, smart buildings, industrial equipment, and environmental networks. Differential privacy (DP) limits the change in an output distribution when the dataset changes according to a declared neighboring relation [1,2]. The definition does not assume that records are statistically independent. The practical difficulty in correlated sensing is instead that a component-level or time-point-level relation may be narrower than the user, event, or dependency neighborhood that an application intends to protect. Correlated observations can also retain predictive information about an attribute without violating the stated DP inequality.

This paper calls the latter phenomenon correlation-assisted inference. Indoor light and CO₂ jointly indicate occupancy, accelerometer and gyroscope features jointly describe motion, and nearby motes observe similar environmental trends. Pufferfish makes the protected secrets, discriminative pairs, and data-generating assumptions explicit [3,4]; Blowfish specifies protected distinctions through a policy graph [5]; and temporal analyses show how repeated releases interact with temporal dependence [6,7]. These results motivate an IoT mechanism whose formal privacy unit is explicit and whose empirical calibration recognizes cross-channel and lagged structure.

Dependence-aware DP, Bayesian DP, correlated DP, and dependent-tuple analyses formalize related concerns under different models [8,9,10]. Workload mechanisms and streaming mechanisms solve different release problems: the matrix mechanism optimizes a fixed linear workload [11], CTS-DP publishes correlated time series [12], and CGM uses temporally correlated Gaussian noise under $(ϵ,\delta )$-local DP [13]. GC-DP instead targets the central release of multichannel, window-level representations. These methods are not interchangeable baselines unless the privacy unit, trust model, value of $\delta$, workload, and release schedule are matched.

GC-DP represents sensing components by a weighted calibration graph $\widehat{\mathcal{G}}=(\mathcal{V},\mathcal{E},\mathbf{W})$ and distinguishes it from the fixed policy graph ${\mathcal{G}}_0$ that declares adjacency. Weighted degree ${\overline{r}}_i$ is an allocation surrogate, not a formal leakage bound. A certified sensitivity $B_{{\mathcal{G}}_0,k}$ is derived for every released coordinate $q_k$, and a graph-expanded empirical influence ${\widehat{\xi }}_k$ may only increase the calibrated scale $s_k=\max \{B_{{\mathcal{G}}_0,k},{\widehat{\xi }}_k\}$. Local budgets ${ϵ}_k$ are computed from exposure, influence, and validation utility while satisfying ${\sum }_k{ϵ}_k\le {ϵ}_{\mathrm{rel}}$. The release is ${\widehat{y}}_k={\mathrm{\Pi }}_k\left(q_k\left(\mathcal{D}\right)\right)+\mathrm{Laplace}(0,s_k/{ϵ}_k)$.

The practical contribution is the integration of lag-aware dependency estimation, conservative sensitivity certification, and risk–utility allocation in one IoT release pipeline. Absolute lagged Pearson correlation was selected because it is bounded, sign-invariant, interpretable, and computable in $O\left(M^2(2L+1)N\right)$ time; thresholding and a degree cap produce an auditable sparse graph. Compression reduces redundant empirical scores but never reduces the certified bound. These choices are pragmatic rather than universally optimal; mutual information, partial correlation, or domain graphs may be substituted when their calibration and sensitivity are specified. When graph or utility statistics use protected records, GC-DP assigns budgets ${ϵ}_G$, ${ϵ}_{\tau }$, ${ϵ}_{\mu }$, and ${ϵ}_{\xi }$ to their release, with ${ϵ}_{\mathrm{cal}}={ϵ}_G+{ϵ}_{\tau }+{ϵ}_{\mu }+{ϵ}_{\xi }$ and total cost ${ϵ}_{\mathrm{cal}}+{ϵ}_{\mathrm{rel}}$.

The evaluation uses UCI-HAR, WISDM, Occupancy Detection, and Intel Lab Data. The experimental implementation follows Algorithms 1–4: it applies the fixed component-occurrence adjacency, includes the certified coordinatewise sensitivity floor, and then uses graph exposure, empirical influence, and validation utility to allocate the release budget. The tables report higher utility and lower attribute-inference AUC for GC-DP than for Lap-DP, Gau-DP, Ada-DP, and Risk-DP. These comparisons concern the matched central-release implementations evaluated here; mechanisms with different secret definitions, trust models, workloads, values of $\delta$, or release schedules remain scope comparisons rather than numerical baselines.

The contributions are as follows: (1) a query-independent graph-expanded adjacency that states the protected component-level neighborhood; (2) a separation between certified global sensitivity and empirical graph influence; (3) an explicit public/private calibration boundary and composed privacy accounting; and (4) an empirical evaluation of utility, attribute inference, ablations, and computational cost on four public IoT sensing datasets.

The remainder of this paper is organized as follows. Section 2 reviews differential privacy for IoT data analytics, correlation-aware privacy, and graph-structured budget allocation. Section 3 introduces the notation, IoT stream model, differential privacy background, and graph-based privacy–utility objective. Section 4 presents the GC-DP framework, including correlation graph construction, graph-calibrated sensitivity estimation, adaptive budget allocation, and the complete private release mechanism. Section 5 reports the experimental settings, utility comparison, privacy leakage analysis, ablation study, and runtime evaluation. Section 6 concludes the paper.

Algorithm 1 Data-Driven Correlation Graph Construction

Require: Public or privately calibrated bounded data/score vector, L, $\lambda$, $\tau$, degree cap K, smoothing coefficient $\alpha$ Ensure: Calibration graph $\widehat{\mathcal{G}}$, normalized adjacency matrix $\tilde{\mathbf{W}}$, graph exposure vector $\overline{\mathbf{r}}$  1: Apply fixed bounded normalization parameters.  2: Obtain $S_{ij}$ from public normalized data or read the already released private score vector $\tilde{S}$; do not access protected calibration records again.  3: Form undirected candidates ${\mathcal{E}}_{\tau }=\{\{i,j\}:S_{ij}\ge \tau ,i<j\}$ and sort them by decreasing $S_{ij}$ with a lexicographic tie break.  4: Initialize $\mathbf{W}=\mathbf{0}$. In sorted order, accept $\{i,j\}$ only if $\mathrm{deg}\left(i\right)<K$ and $\mathrm{deg}\left(j\right)<K$, then set $w_{ij}=w_{ji}=S_{ij}$.  5: Compute $\tilde{\mathbf{W}}={\mathbf{D}}^{-1/2}\mathbf{W}{\mathbf{D}}^{-1/2}$; use zero inverse degree for isolated nodes.  6: Compute direct weighted degree $d_m={\sum }_{j\ne m}{w}_{mj}$ for each node $v_m$.  7: Compute smoothed exposure score $r_m=\alpha d_m+(1-\alpha ){\sum }_{j\ne m}{\tilde{w}}_{mj}{d}_j$.  8: Normalize $r_m$ into ${\overline{r}}_m\in [0,1]$ for all m.  9: return $\widehat{\mathcal{G}}=(\mathcal{V},\mathcal{E},\mathbf{W})$, $\tilde{\mathbf{W}}$, and $\overline{\mathbf{r}}$

Algorithm 2 Graph-Calibrated Sensitivity Estimation

Require: Query q, fixed adjacency ${\sim }_{{\mathcal{G}}_0}$, certified bounds $\left\{B_{{\mathcal{G}}_0,k}\right\}$, calibrated graph $\widehat{\mathcal{G}}$, exposure $\overline{\mathbf{r}}$, public/private calibration data, $\gamma ,{\tau }_c,\kappa ,g_{\max }$ Ensure: Certified bounds $\left\{B_{{\mathcal{G}}_0,k}\right\}$, empirical scores $\left\{{\widehat{\xi }}_k\right\}$, release numerators $\left\{s_k\right\}$  1: for each released coordinate k do  2:    Verify analytically that $B_{{\mathcal{G}}_0,k}\ge {\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$; otherwise use the clipped range $U_k-L_k$.  3:    On public calibration data, compute the bounded mask score using fixed $a\left(k\right)$ and $C_k$; in private mode, read the released coordinate of $V_{\xi }$ without accessing protected records again.  4:    Inflate and cap the public empirical score, or project the private score, to obtain ${\widehat{\xi }}_k$.  5:    Set $s_k=\max \{B_{{\mathcal{G}}_0,k},{\widehat{\xi }}_k\}$.  6: end for  7: return ${\{B_{{\mathcal{G}}_0,k},{\widehat{\xi }}_k,s_k\}}_{k=1}^d$

Algorithm 3 Utility-Guided Adaptive Privacy Budget Allocation

Require: ${ϵ}_{\mathrm{rel}}$, calibrated $\overline{\mathbf{r}}$, $\left\{s_k\right\}$, $\left\{{\mu }_k\right\}$, ${ϵ}_{\min }$, ${\beta }_r,{\beta }_g,{\beta }_u$ Ensure: $\mathit{ϵ}={[{ϵ}_1,\dots ,{ϵ}_d]}^{\top }$  1: Verify that $0<{ϵ}_{\min }<{ϵ}_{\mathrm{rel}}/d$.  2: for each output coordinate k do  3:    Compute ${\overline{r}}_k^{\left(q\right)}$ from $a\left(k\right)$, then $p_k={({\overline{r}}_k^{\left(q\right)}+\eta )}^{{\beta }_r}{(s_k+\eta )}^{{\beta }_g}$ and $u_k={({\mu }_k+\eta )}^{{\beta }_u}$.  4:    Set $h_k=u_k/(p_k+\eta )$.  5: end for  6: Set ${ϵ}_k={ϵ}_{\min }+({ϵ}_{\mathrm{rel}}-d{ϵ}_{\min })h_k/{\sum }_{j=1}^d{h}_j$.  7: return $\mathit{ϵ}$

Algorithm 4 Graph-Calibrated Differential Privacy Mechanism

Require: Protected data $\mathcal{D}$, query q, fixed adjacency ${\sim }_{{\mathcal{G}}_0}$, release budget ${ϵ}_{\mathrm{rel}}$, fixed/public or ${ϵ}_{\mathrm{cal}}$-DP parameter object $\theta$ Ensure: Privatized analytics output $\widehat{\mathbf{y}}$  1: Verify $s_k\ge B_{{\mathcal{G}}_0,k}\ge {\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$, ${ϵ}_k>0$, and ${\sum }_k{ϵ}_k\le {ϵ}_{\mathrm{rel}}$ for every possible $\theta$.  2: for each released coordinate $k=1,\dots ,d$ do  3:    Set $y_k={\mathrm{\Pi }}_k\left(q_k\left(\mathcal{D}\right)\right)$ and $b_k=s_k/{ϵ}_k$.  4:    Sample $Z_k\sim \mathrm{Laplace}(0,b_k)$ independently and release ${\widehat{y}}_k=y_k+Z_k$.  5: end for  6: return $\widehat{\mathbf{y}}={[{\widehat{y}}_1,\dots ,{\widehat{y}}_d]}^{\top }$

2. Related Work

2.1. Differential Privacy for IoT Sensing, Streams, and Private Learning

The Laplace and Gaussian mechanisms calibrate noise to global sensitivity under an explicitly chosen adjacency, and sequential composition accounts for repeated access [1,2]. Continual-observation mechanisms address repeated stream releases [14,15], while event-level and w-event privacy distinguish one event from a bounded temporal interval [16]. Local DP changes the trust model by perturbing at the source [17,18]. These distinctions matter for IoT evaluation: a central pure-$ϵ$ release is not directly comparable with an $(ϵ,\delta )$ local mechanism solely by matching $ϵ$.

GC-DP concerns a central release of clipped window-level components. It does not replace user-level, device-level, continual-observation, or local privacy; those guarantees require their own adjacency and accounting. The experimental tables compare mechanisms implemented within the same central-release pipeline and with the same data partitions and release budgets. Broader mechanisms are compared by scope because their privacy units, trust models, workloads, or release schedules differ.

2.2. Correlation-Aware Privacy for Dependent Spatiotemporal Data

Standard DP does not require records to be independent; dependence becomes relevant when adjacency protects a smaller unit than the intended secret or when correlated observations provide auxiliary evidence for inference. Pufferfish makes secrets, discriminative pairs, and distribution families explicit [3], and the Markov Quilt mechanism instantiates it for Bayesian networks and Markov chains [4]. Blowfish uses a policy graph over possible data values [5]; that graph is conceptually different from GC-DP’s empirical graph over sensing components. Bayesian DP, correlated DP, and dependent DP quantify dependence under different probabilistic or sensitivity models [8,9,10].

GC-DP fixes the protected expansion relation before observing the protected release data and uses the learned component graph only for calibration. This separation avoids defining adjacency through an observed query displacement. Graph degree and attribute-inference scores remain empirical indicators; they do not modify or amplify the meaning of the formal DP inequality after release.

Other peer-reviewed dependence-aware studies cover feature selection, mobile crowdsensing, correlated trajectories, and correlated multi-attribute estimation [19,20,21,22]. Recent private time-series work also distinguishes user-level local shape extraction from stream-publication reuse of perturbations [23,24]. These task-specific assumptions reinforce the need to state scope before comparing numerical utility.

2.3. Graph-Structured Privacy Modeling and Adaptive Budget Allocation

The matrix mechanism chooses strategy queries for a specified workload of linear counting queries [11]; it is not a generic classifier-release baseline. Location and temporal methods use geometry, Markov transitions, or temporal accounting [6,7]. CTS-DP constructs correlated Laplace noise for time-series publication [12], whereas CGM injects correlated Gaussian noise under $(ϵ,\delta )$-local DP using public aggregate autocorrelation [13]. A fair empirical comparison requires the same workload, protected unit, trust model, $\delta$, and schedule.

GC-DP is distinguished by a lag-aware graph over heterogeneous components, certified coordinatewise sensitivity under a fixed expanded adjacency, and task-aware budget allocation. The graph form was chosen to support transparent inspection and periodic reuse, not because weighted degree has a formal equivalence to leakage or because correlation graphs are optimal for every IoT process.

3. Preliminaries

This section distinguishes the declared privacy unit, fixed policy adjacency, learned calibration graph, input-node index, and output-coordinate index.

Table 1. Main notation used in the paper.

Symbol	Meaning
$\mathcal{D}$	IoT sensing dataset composed of multivariate time-series records
N	Number of sensing records or time-indexed samples in $\mathcal{D}$
M	Number of nodes in the calibration graph
d	Number of released query coordinates
${\mathbf{x}}_t$	Multivariate sensing vector observed at time t
$x_{t,m}$	Observation of the m-th sensing channel at time t
${\mathcal{G}}_0$	Policy graph fixed independently of the protected release data
$\mathcal{I},u=(t,v_i)$	Atomic occurrence set and one record–component occurrence
$i,k$	Input graph-node index and released output-coordinate index
${\mathsf{\Gamma }}_{{\mathcal{G}}_0}\left(u\right)$	Predeclared expansion set for protected atomic occurrence u
$\widehat{\mathcal{G}}=(\mathcal{V},\mathcal{E},\mathbf{W})$	Public or privately calibrated weighted dependency graph
$v_i$	Graph node corresponding to sensing component i
$w_{ij}$	Edge weight measuring dependency strength between nodes $v_i$ and $v_j$
$q(·)$	Analytics query or feature extraction function
$q_k,{\mathrm{\Pi }}_k,[L_k,U_k]$	Output coordinate, fixed projection, and clipped output interval
$a\left(k\right)$	Fixed map from output coordinate k to associated graph nodes
${\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$	True coordinate sensitivity under the fixed adjacency
$B_{{\mathcal{G}}_0,k}$	Certified sensitivity bound for released coordinate k
${\widehat{\xi }}_k$	Empirical graph-expanded influence score for coordinate k
$s_k$	Release scale numerator $\max \{B_{{\mathcal{G}}_0,k},{\widehat{\xi }}_k\}$
${\overline{r}}_i,{\mu }_k$	Empirical graph-exposure and bounded utility scores
${ϵ}_G,{ϵ}_{\tau },{ϵ}_{\mu },{ϵ}_{\xi }$	Private graph, threshold, utility, and influence budgets
${ϵ}_{\mathrm{cal}},{ϵ}_{\mathrm{rel}}$	Total calibration and release privacy budgets
${ϵ}_k$	Release budget assigned to output coordinate k
$\theta$	Fixed or privately calibrated parameter object
$\mathcal{M}(·)$	Randomized privacy mechanism released to the analyst
$\mathbf{z}$	Random perturbation injected for privacy protection
$\mathcal{U}$	Utility score of the privatized analytics output

summarizes the notation.

3.1. IoT Sensing Streams and Analytics Queries

Let $\mathcal{D}=\{{\mathbf{x}}_1,\dots ,{\mathbf{x}}_N\}$ contain clipped multivariate observations. Before calibration, the controller fixes atomic occurrence-level units $\mathcal{I}\subseteq \{1,\dots ,N\}\times \mathcal{V}$ and their domains. A graph node $v_i$ is a component type, whereas an atomic unit $(t,v_i)$ is that component’s occurrence in record or window t; the two are not interchangeable. The experiments protect a supplied feature-window coordinate for UCI-HAR, a sensor-axis contribution within one WISDM window, a time-stamped channel value for Occupancy Detection, and a mote–channel contribution within one Intel Lab window. The guarantee is component-occurrence privacy, not user-level or device-level privacy. User- or device-level protection requires grouping all corresponding occurrences into one adjacency and generally has a larger sensitivity.

The released query is $q:\mathcal{D}\to {\mathbb{R}}^d$, with coordinate $q_k$ distinguished from input-node index i. Aggregate queries and clipped feature representations are both covered. A deterministic projection ${\mathrm{\Pi }}_k$ maps coordinate k to its fixed interval $[L_k,U_k]$ before randomization.

Let ${\mathsf{\Gamma }}_{{\mathcal{G}}_0}\left(u\right)\subseteq \mathcal{I}$ be a predeclared expansion set obtained from a public policy graph ${\mathcal{G}}_0$ or a specification independent of the protected data, where $u=(t,v_i)$ is one atomic occurrence. Datasets satisfy $\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }$ when, for one u, they agree outside ${\mathsf{\Gamma }}_{{\mathcal{G}}_0}\left(u\right)$ and may differ arbitrarily within the fixed clipped domains inside that set. The conventional component-replacement relation is recovered when ${\mathsf{\Gamma }}_{{\mathcal{G}}_0}\left(u\right)=\left\{u\right\}$. The relation is defined on input occurrences and does not depend on the query, observed displacement, or learned sensitivity. Raw-channel, temporal-segment, and feature-level graphs are separate instantiations and are not mixed within one run. In the benchmark experiments, ${\mathcal{G}}_0$ and its occurrence-level expansions are fixed from the public data specification before calibration; the learned weighted graph $\widehat{\mathcal{G}}$ is used only for sensitivity inflation and budget allocation.

3.2. Differential Privacy Under Correlated Observations

A randomized mechanism $\mathcal{M}$ is $ϵ$-DP under ${\sim }_{{\mathcal{G}}_0}$ if $\mathrm{Pr}[\mathcal{M}\left(\mathcal{D}\right)\in \mathcal{S}]\le e^{ϵ}\mathrm{Pr}[\mathcal{M}\left({\mathcal{D}}^{\prime }\right)\in \mathcal{S}]$ for every $\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }$ and measurable $\mathcal{S}$. The guarantee limits distinguishability for exactly those pairs. It does not state that an attribute is unrecoverable from correlations, nor does it automatically extend component-record privacy to a whole user or device.

Correlation-assisted attribute inference is evaluated separately from the formal guarantee. A lower attack AUC or F1 indicates weaker performance for the evaluated adversary, not absence of privacy risk. This distinction also explains why graph-weighted degree can guide allocation without being presented as a theorem-level measure of leakage.

3.3. Correlation Graph and Privacy–Utility Objective

The calibration graph $\widehat{\mathcal{G}}=(\mathcal{V},\mathcal{E},\mathbf{W})$ has M nodes and bounded weights $w_{ij}\in [0,1]$. Its node representation is fixed for each experiment. The graph ranks empirical dependence for budget allocation; the independent policy graph ${\mathcal{G}}_0$ defines adjacency. The two coincide only when $\widehat{\mathcal{G}}$ is constructed entirely from public information and explicitly adopted as policy before the protected release data are observed.

The normalized degree score ${\overline{r}}_i$ is treated as an interpretable exposure surrogate. It is neither equal to nor an upper bound on privacy loss, mutual information, reconstruction success, or attack AUC. The ablation and attribute-inference experiments evaluate its empirical contribution, while the certified sensitivity bound remains the basis of the formal guarantee.

GC-DP distributes a release budget so that ${\sum }_{k=1}^d{ϵ}_k\le {ϵ}_{\mathrm{rel}}$. Exposure and certified sensitivity decrease a coordinate’s allocation weight, while bounded validation utility increases it. If any of these quantities is obtained from protected records, its private calibration is included in ${ϵ}_{\mathrm{cal}}$ before the allocation is used.

4. Methodology

4.1. Data-Driven Correlation Graph Construction

GC-DP constructs a bounded calibration graph $\widehat{\mathcal{G}}=(\mathcal{V},\mathcal{E},\mathbf{W})$ over the node representation fixed for the task. The graph ranks synchronous and lagged empirical dependence for allocation; it does not itself define privacy loss. Calibration and protected release are separate stages, and every calibration quantity is either independent of the protected records or released under an explicit calibration budget.

Let the calibration matrix contain $N_{\mathrm{cal}}$ bounded observations of M fixed nodes. Public medians and interquartile ranges may be used for robust normalization. If these statistics are computed from protected records, their release is included in the parameter object $\theta$ and budgeted; computing them first and then treating them as constants is not sufficient. Fixed physical ranges or public training statistics are preferred because they make clipping and sensitivity auditable.

For nodes i and j, let ${\rho }_{ij}^{\left(\mathcal{l}\right)}$ be the absolute Pearson correlation at lag ℓ after fixed bounded preprocessing. Set ${\rho }_{ij}^{\left(\mathcal{l}\right)}=0$ when fewer than two aligned pairs remain or either aligned series has zero variance. The bounded score is $S_{ij}=\lambda {\rho }_{ij}^{\left(0\right)}+(1-\lambda ){\max }_{\left|\mathcal{l}\right|\le L}{\rho }_{ij}^{\left(\mathcal{l}\right)}$. After calibration, $w_{ij}=S_{ij}$ when $S_{ij}\ge \tau$ and zero otherwise. Absolute lagged correlation was selected because it is bounded, sign-invariant, inexpensive, and directly inspectable. It does not distinguish direct from mediated dependence, so partial correlation, mutual information, or a domain graph may be preferable when supported by the application and privacy accounting.

Thresholding first forms the undirected candidate set ${\mathcal{E}}_{\tau }=\{\{i,j\}:S_{ij}\ge \tau ,i<j\}$. Candidates are sorted by decreasing $S_{ij}$, with lexicographic node order used as a deterministic tie-breaker. Starting from an empty undirected graph, an edge $\{i,j\}$ is accepted only when both current endpoint degrees are strictly smaller than K. This greedy symmetric rule guarantees $\mathrm{deg}\left(i\right)\le K$ for every node; it does not reinstate sub-threshold neighbors, and isolated nodes are permitted. The accepted edge receives $w_{ij}=w_{ji}=S_{ij}$. Then $\tilde{\mathbf{W}}={\mathbf{D}}^{-1/2}\mathbf{W}{\mathbf{D}}^{-1/2}$, with inverse-degree entries defined as zero for isolated nodes. The construction limits weak or spurious links while preserving an auditable sparse structure; it is a deterministic sparsification heuristic, not an optimality claim.

The allocation surrogate uses $d_i={\sum }_{j\ne i}{w}_{ij}$ and $r_i=\alpha d_i+(1-\alpha ){\sum }_{j\ne i}{\tilde{w}}_{ij}{d}_j$. If ${\max }_i{r}_i>{\min }_i{r}_i$, min–max normalization gives ${\overline{r}}_i=(r_i-{\min }_j{r}_j)/({\max }_j{r}_j-{\min }_j{r}_j)$; otherwise, set every ${\overline{r}}_i=0$. It ranks direct and one-hop graph exposure. No formal equivalence between weighted degree and DP leakage is assumed; the attack evaluation tests only whether the surrogate improves resistance for the specified empirical adversary.

Algorithm 1 receives an already public or privately released score vector and applies only post-processing. It returns $\widehat{\mathcal{G}}$, $\tilde{\mathbf{W}}$, and $\overline{\mathbf{r}}$.

Direct computation over $M(M-1)/2$ pairs, $2L+1$ lags, and $N_{\mathrm{cal}}$ aligned observations costs $O\left(M^2(2L+1)N_{\mathrm{cal}}\right)$ time. Thresholding and per-node ranking cost $O\left(M^2\log M\right)$ time; the dense scores require $O\left(M^2\right)$ memory beyond the input. FFT-based correlation can reduce the lag term for long streams, but the reported implementation uses direct correlation.

4.2. Public and Private Calibration

Collect all release-dependent parameters in $\theta =(\mathbf{W},\overline{\mathbf{r}},\mathit{\mu },\widehat{\mathit{\xi }},\tau ,\mathit{ϵ})$. In public-calibration mode, $\theta$, clipping bounds, and tuning choices use only public information independent of the protected records. A historical or validation split is not automatically public; if it contains protected units, it must be included in the accounting.

In private-calibration mode, fixed preprocessing maps the $P=M(M-1)/2$ pairwise scores to a vector $S\left(\mathcal{D}\right)\in {[0,1]}^P$. Define ${\mathrm{\Delta }}_{1}S={\sup }_{\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }}{\parallel S\left(\mathcal{D}\right)-S\left({\mathcal{D}}^{\prime }\right)\parallel }_1$. GC-DP releases ${\tilde{S}}_j={\mathrm{\Pi }}_{[0,1]}(S_j\left(\mathcal{D}\right)+Z_j)$ with independent $Z_j\sim \mathrm{Laplace}(0,{\mathrm{\Delta }}_{1}S/{ϵ}_G)$. The universal bound ${\mathrm{\Delta }}_{1}S\le P$ is valid because every coordinate is in $[0,1]$; a tighter value may be used only when proved for the stated score and adjacency. Thresholding, degree capping, normalization, compression, and exposure scoring are post-processing. For utility and empirical-influence vectors $V_{\mu }\left(\mathcal{D}\right),V_{\xi }\left(\mathcal{D}\right)\in {[0,1]}^d$, define ${\mathrm{\Delta }}_1{V}_a={\sup }_{\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }}{\parallel V_a\left(\mathcal{D}\right)-V_a\left({\mathcal{D}}^{\prime }\right)\parallel }_1$ for $a\in \{\mu ,\xi \}$. Independent coordinatewise Laplace noise with scales ${\mathrm{\Delta }}_1{V}_{\mu }/{ϵ}_{\mu }$ and ${\mathrm{\Delta }}_1{V}_{\xi }/{ϵ}_{\xi }$, followed by projection to ${[0,1]}^d$, releases these vectors; the universal bounds are ${\mathrm{\Delta }}_1{V}_a\le d$.

If protected validation utility $U(\mathcal{D},t)\in [0,1]$ selects $\tau$ from a finite set $\mathcal{T}$, the exponential mechanism samples t with probability proportional to $\exp \{{ϵ}_{\tau }U(\mathcal{D},t)/\left(2\mathrm{\Delta }U\right)\}$, where $\mathrm{\Delta }U={\sup }_{\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }}|U(\mathcal{D},t)-U({\mathcal{D}}^{\prime },t)|\le 1$. The calibration budget is ${ϵ}_{\mathrm{cal}}={ϵ}_G+{ϵ}_{\tau }+{ϵ}_{\mu }+{ϵ}_{\xi }$. Clipping and normalization parameters must remain public/fixed or be included in a separately specified DP parameter release; they cannot redefine adjacency. Private graph calibration can be noisy under the universal bound, which is an explicit utility limitation rather than an unaccounted guarantee.

4.3. Graph-Calibrated Sensitivity Estimation

Let $q\left(\mathcal{D}\right)=(q_1\left(\mathcal{D}\right),\dots ,q_d\left(\mathcal{D}\right))$. For the fixed relation ${\sim }_{{\mathcal{G}}_0}$, the true sensitivity of output coordinate k is

$${\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)=\underset{\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }}{\sup }|{\mathrm{\Pi }}_k\left(q_k\left(\mathcal{D}\right)\right)-{\mathrm{\Pi }}_k\left(q_k\left({\mathcal{D}}^{\prime }\right)\right)|.$$

A certificate $B_{{\mathcal{G}}_0,k}$ must satisfy $B_{{\mathcal{G}}_0,k}\ge {\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$. Counts, fixed-size means, and histograms use analytic bounds from the declared adjacency and ranges. For an arbitrary extractor clipped to $[L_k,U_k]$, $B_{{\mathcal{G}}_0,k}=U_k-L_k$ is always valid, although potentially loose. The vector query obeys ${\mathrm{\Delta }}_{{\mathcal{G}}_0}^{\left(1\right)}q\le {\sum }_{k=1}^d{B}_{{\mathcal{G}}_0,k}$; in general, the maximum coordinate bound is not an ℓ₁ vector-sensitivity bound.

Bounded leave-one-node masking measures observed task influence, not global sensitivity. Fix a mapping $a:\{1,\dots ,d\}\to 2^{\mathcal{V}}$ from every output coordinate to its associated graph nodes; when $d=M$, $a\left(k\right)=\left\{v_k\right\}$. Let ${\delta }_{ik}=|{\mathrm{\Pi }}_k\left(q_k\left({\mathcal{D}}_{\mathrm{cal}}\right)\right)-{\mathrm{\Pi }}_k\left(q_k\left(M_i\left({\mathcal{D}}_{\mathrm{cal}}\right)\right)\right)|$, where $M_i$ applies the prespecified mask to node type $v_i$. For a fixed compressed set $C_k\subseteq \mathcal{V}$, define

$${\widehat{\xi }}_k=\min \left\{g_{\max },\kappa \underset{i\in a\left(k\right)}{\max }\left[{\delta }_{ik}+\gamma {\overline{r}}_i\sum _{j\in C_k}{\tilde{w}}_{ij}{\delta }_{jk}\right]\right\}.$$

The set $C_k$ retains one representative from a pair with normalized similarity at least ${\tau }_c$, choosing the representative with greater exposure and using a fixed node-index tie break. This formula is evaluated on public calibration data; with protected calibration data, Algorithm 2 consumes the already released private vector $V_{\xi }$ from Section 4.2 rather than remasking protected records. Inflation by $\kappa \ge 1$ and clipping at $g_{\max }$ stabilize this empirical score, but no finite $\kappa$ converts a validation maximum into a worst-case certificate. Compression and clipping therefore affect only ${\widehat{\xi }}_k$. The release uses

$$s_k=\max \{B_{{\mathcal{G}}_0,k},{\widehat{\xi }}_k\},$$

so empirical estimation error cannot lower the certified bound. The analytic route is used whenever the query algebra and adjacency yield a closed-form global bound; bounded perturbation is used only to rank influence for allocation or conservatively increase $s_k$.

This separation explains the practical role of graph expansion and compression. Expansion directs more noise or less budget toward coordinates linked to influential nodes, whereas compression avoids repeatedly counting nearly collinear evidence in the empirical score. Neither operation is claimed to be optimal, and neither is allowed to reduce formal sensitivity.

Proposition 1.

For every coordinate k, $s_k\ge B_{{\mathcal{G}}_0,k}\ge {\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$. Thus, $s_k$ is a valid coordinatewise sensitivity bound. Graph compression, masking error, and the choices of γ, ${\tau }_c$, κ, and $g_{\max }$ may change utility and empirical attack behavior but cannot invalidate this inequality because the independently certified term remains at the maximum.

4.4. Utility-Guided Adaptive Privacy Budget Allocation

The certified scale numerators $s_k$ protect the declared adjacency. GC-DP then allocates ${ϵ}_{\mathrm{rel}}$ across coordinates to trade task utility against empirical graph exposure without changing those certificates.

Let ${ϵ}_k>0$ be the budget for output coordinate k, with ${\sum }_{k=1}^d{ϵ}_k\le {ϵ}_{\mathrm{rel}}$. The bounded utility score ${\mu }_k\in [0,1]$ is the normalized reduction in validation utility when the associated node or feature group is masked; aggregates use a bounded contribution score. The score and resulting allocation are privacy-dependent. They must be computed from public information or released within ${ϵ}_{\mu }$. A non-private allocation computed from the protected release data is outside Theorem 1.

Using the fixed coordinate–node map $a\left(k\right)$ from Section 4.3, define coordinate exposure by

$${\overline{r}}_k^{\left(q\right)}={\displaystyle \frac{1}{\left|a\right(k\left)\right|}}\sum _{v_i\in a\left(k\right)}{\overline{r}}_i.$$

Let $p_k={({\overline{r}}_k^{\left(q\right)}+\eta )}^{{\beta }_r}{(s_k+\eta )}^{{\beta }_g}$, $u_k={({\mu }_k+\eta )}^{{\beta }_u}$, and $h_k=u_k/(p_k+\eta )$. Larger $p_k$ reduces the allocated budget and increases noise; larger $u_k$ preserves task-critical coordinates. The exponents ${\beta }_r$, ${\beta }_g$, and ${\beta }_u$ control the three effects.

With $0<{ϵ}_{\min }<{ϵ}_{\mathrm{rel}}/d$, allocation is

$${ϵ}_k={ϵ}_{\min }+({ϵ}_{\mathrm{rel}}-d{ϵ}_{\min }){\displaystyle \frac{h_k}{{\sum }_{j=1}^d{h}_j}}.$$

The floor prevents numerical degeneracy and the normalization makes the total budget exactly ${ϵ}_{\mathrm{rel}}$.

When ${\beta }_r=0$, graph exposure does not affect allocation, giving the utility-only Ada-DP reduction; when ${\beta }_u=0$, validation utility does not affect it, giving the exposure-only Risk-DP reduction. The rule is a transparent allocation heuristic rather than the solution of a universal optimality criterion.

Algorithm 3 is the post-processing of the fixed or privately calibrated object $\theta$ and requires $O\left(d\right)$ time and memory.

Proposition 2.

Algorithm 3 guarantees ${ϵ}_k\ge {ϵ}_{\min }$ and ${\sum }_{k=1}^d{ϵ}_k={ϵ}_{\mathrm{rel}}$. This follows immediately from positivity of $h_k$ and summing the normalized fractions.

4.5. Complete Graph-Calibrated Private Release Mechanism

The release stage accepts a fixed or privately calibrated parameter object $\theta$; it does not recompute graph, threshold, empirical influence, utility, clipping, or allocation statistics from the unprotected release data. For $k=1,\dots ,d$, it releases

$${\widehat{y}}_k={\mathrm{\Pi }}_k\left(q_k\left(\mathcal{D}\right)\right)+Z_k,Z_k\stackrel{\mathrm{ind}}{\sim }\mathrm{Laplace}(0,s_k/{ϵ}_k),$$

where $s_k\ge {\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$ and ${\sum }_k{ϵ}_k\le {ϵ}_{\mathrm{rel}}$. The graph may increase $s_k$ or decrease ${ϵ}_k$, but it cannot lower the certified bound.

Theorem 1.

Fix ${\sim }_{{\mathcal{G}}_0}$ independently of the protected data. Suppose that for every feasible fixed calibration output θ, each nonconstant coordinate has $s_k\left(\theta \right)>0$, $s_k\left(\theta \right)\ge {\mathrm{\Delta }}_{{\mathcal{G}}_0,k}\left(q\right)$, ${ϵ}_k\left(\theta \right)>0$, and ${\sum }_k{ϵ}_k\left(\theta \right)\le {ϵ}_{\mathrm{rel}}$; a coordinate with zero sensitivity is released deterministically. Then the release kernel $R_{\theta }$ defined by Algorithm 4 is ${ϵ}_{\mathrm{rel}}$-DP under ${\sim }_{{\mathcal{G}}_0}$ for every such fixed θ. If an ${ϵ}_{\mathrm{cal}}$-DP calibration kernel C produces θ from the same protected records under the same relation, the joint adaptive procedure $C(\mathcal{D};d\theta )R_{\theta }(\mathcal{D};d\widehat{\mathbf{y}})$, and hence its released marginal, is $({ϵ}_{\mathrm{cal}}+{ϵ}_{\mathrm{rel}})$-DP.

Proof. 

For fixed $\theta$ and any $\mathcal{D}{\sim }_{{\mathcal{G}}_0}{\mathcal{D}}^{\prime }$, independence of the Laplace variables gives

$${\displaystyle \frac{p_{\theta }(\widehat{\mathbf{y}}\mid \mathcal{D})}{p_{\theta }(\widehat{\mathbf{y}}\mid {\mathcal{D}}^{\prime })}}\le \exp \left({\displaystyle \sum _{k=1}^d}{\displaystyle \frac{{ϵ}_k|{\mathrm{\Pi }}_k\left(q_k\left(\mathcal{D}\right)\right)-{\mathrm{\Pi }}_k\left(q_k\left({\mathcal{D}}^{\prime }\right)\right)|}{s_k}}\right)\le \exp \left({\displaystyle \sum _{k=1}^d}{ϵ}_k\right)\le e^{{ϵ}_{\mathrm{rel}}}.$$

Integration gives the same inequality for measurable output sets for every fixed feasible $\theta$. Multiplying the $e^{{ϵ}_{\mathrm{cal}}}$ measure bound for C by the uniform $e^{{ϵ}_{\mathrm{rel}}}$ kernel bound for $R_{\theta }$ and integrating over $\theta$ proves the joint and marginal $({ϵ}_{\mathrm{cal}}+{ϵ}_{\mathrm{rel}})$ guarantee. ☐

A graph learned from sensitive data may tune $\theta$, but it cannot redefine adjacency after the data are observed. Reusing an already released $\widehat{\mathbf{y}}$ is post-processing; generating fresh releases from the same protected units incurs composition. A downstream model conducts post-processing only when it receives no additional raw protected data.

The theorem covers one invocation of q over the declared dataset. Disjoint occurrence sets may use parallel composition only when the fixed adjacency cannot change more than one set; overlapping windows, repeated release of the same occurrence, or a release of an entire test matrix requires sequential or appropriate continual-observation accounting. Each benchmark result below evaluates one declared release invocation at the displayed budget. The empirical comparison does not claim a continual-observation guarantee for an indefinitely repeated stream; such a deployment must compose repeated accesses separately.

5. Experiments

5.1. Experimental Settings

The evaluation uses four public benchmarks covering wearable activity recognition, room occupancy, and distributed environmental sensing.

Table 2. Datasets, tasks, graph nodes, and declared privacy units.

Dataset	Task	Graph Node	Protected Component-Record Unit	Source
UCI-HAR	Six-class activity	One supplied window feature	One clipped feature coordinate in one supplied window	UCI [25]
WISDM	Eighteen-class activity	One sensor-axis window	One clipped sensor-axis contribution in one window	UCI [27]
Occupancy	Binary occupancy	One environmental channel	One clipped channel value at one timestamp	UCI [28]
Intel Lab	Monitor/anomaly	One mote–channel window	One clipped mote–channel contribution in one window	Intel Lab [30]

identifies the source, task, graph nodes, and exact component-record unit protected in each experiment [25,26,27,28,29,30,31]. None of the reported guarantees is user-level or device-level DP.

Figure 1 separates calibration from protected release. A benchmark run has ${ϵ}_{\mathrm{cal}}=0$ only when its graph, clipping, utility scores, and tuning use information that is public and independent of the protected release records. Public availability of a dataset does not by itself establish this separation for a deployment. When calibration records belong to the protected population, Section 4.2 applies and the reported cost is ${ϵ}_{\mathrm{cal}}+{ϵ}_{\mathrm{rel}}$.

All preprocessing, partitioning, clipping, and calibration choices are fixed before the private mechanisms are compared and are reused unchanged across methods and privacy budgets. Invalid timestamps, duplicate entries, and readings outside the physical sensor domain are removed. Short internal gaps are linearly interpolated, and longer incomplete segments are excluded before window formation. Normalization and clipping parameters are fitted only on the calibration/training portion and then frozen. Dataset-provided windows and partitions are retained where available; otherwise, a fixed partition is created before windowing so that no window crosses a split boundary.

Table 3. Dataset-specific preprocessing and evaluation protocol.

Dataset	Window/Overlap	Train/Validation/Test	Missingness and Representation
UCI-HAR	Dataset-supplied feature windows	Fixed train/validation/test partition reused for every method	Supplied bounded feature representation; clipping fitted on calibration/training data
WISDM	Fixed-length sensor-axis windows	Fixed train/validation/test partition reused for every method	Short-gap interpolation, long-gap exclusion, and fixed bounded window features
Occupancy	Time-stamped channels and fixed non-crossing windows	Fixed train/validation/test partition reused for every method	Environmental channels normalized and clipped with training-only statistics
Intel Lab	Synchronized mote–channel windows	Fixed train/validation/test partition reused for every method	Invalid readings removed, short gaps interpolated, long gaps excluded, and window features clipped

summarizes the dataset-specific representation and the invariants enforced by the implementation.

For UCI-HAR, WISDM, and Occupancy Detection, the same fixed lightweight classifier, training procedure, hyperparameters, and class weighting are used for every privacy mechanism; only the privatized representation changes. For Intel Lab Data, anomaly labels and thresholds are generated once from robust deviations in temperature, humidity, light, and voltage and are held fixed for all methods. Aggregate monitoring utility is normalized mean absolute error, using the fixed clipped range of the evaluated channel as the normalization constant. This controlled design prevents downstream-model retuning from confounding the comparison of privacy mechanisms.

Table 4. Included baselines and calibration settings.

Method	Calibration Principle	Perturbation and Allocation Setting
NonPrivate	No perturbation	Clean representation; no privacy guarantee.
Lap-DP	Uniform pure DP	Certified bounds with uniform coordinate budgets.
Gau-DP	Approximate DP	Analytic Gaussian calibration with fixed $\delta$ and certified ℓ2 sensitivity; empirical comparator, not a pure-$ϵ$ mechanism.
Ada-DP	Utility-aware allocation	Uses utility contribution and omits graph-risk calibration.
Risk-DP	Graph-risk allocation	Uses graph risk and omits graph-compressed expanded influence.
GC-DP	Full reported calibration	Uses graph, expanded empirical influence, exposure, and utility.

defines the included mechanisms. Lap-DP, Ada-DP, Risk-DP, and GC-DP are central pure-$ϵ$ releases and use the same coordinate certificates and total release budget. Gau-DP is an approximate-DP perturbation comparator calibrated with the analytic Gaussian mechanism [32]; its fixed $\delta$, ℓ₂ certificate, and calibration rule are held constant across its runs. Because pure and approximate DP are different guarantees, Gau-DP is reported for empirical context and is not described as privacy-identical to the pure-$ϵ$ mechanisms.

Table 5. GC-DP hyperparameters and selection rules.

Parameter	Value	Role/Selection
$L,\lambda ,K,\alpha$	$3,0.6,5,0.7$	Lag, synchronous weight, degree cap, exposure smoothing; fixed
$\gamma ,{\tau }_c$	$1.2,0.85$	Empirical expansion and redundancy; recorded as fixed
$\kappa ,g_{\max },\eta$	$1,1,{10}^{-8}$	Inflation, empirical-score cap, and numerical stabilizer
${\beta }_r,{\beta }_g,{\beta }_u$	$1,1,0.7$	Exposure, certified scale, and utility exponents; fixed
${ϵ}_{\min }$	${ϵ}_{\mathrm{rel}}/\left(100d\right)$	Per-coordinate allocation floor; reserves 1% of the total budget for the floor
$\tau$	UCI/WISDM: 0.20; Occupancy/Intel: 0.15	Validation-F1 maximizer over $\{0.10,0.15,0.20,0.25,0.30\}$
${ϵ}_{\mathrm{rel}}$	$\{0.2,0.5,1,2,4\}$	Total release budget

reports the fixed constants used in the experiments. The sparsification threshold $\tau$ is selected once by validation F1 at $ϵ=1$ from the displayed grid;

Table 6. Mean F1 and oriented attack AUC versus graph threshold $\tau$ at $ϵ=1.0$. Threshold selection uses validation F1 only; attack AUC is reported as a separate diagnostic.

Dataset and metric	$\mathit{\tau }=0.10$	$\mathit{\tau }=0.15$	$\mathit{\tau }=0.20$	$\mathit{\tau }=0.25$	$\mathit{\tau }=0.30$
UCI-HAR F1 (%)	91.6	92.0	92.3	92.1	91.7
UCI-HAR attack AUC	0.596	0.600	0.603	0.612	0.628
WISDM F1 (%)	75.0	75.4	75.8	75.5	74.9
WISDM attack AUC	0.614	0.618	0.621	0.637	0.651
Occupancy F1 (%)	96.0	96.4	96.2	95.9	95.4
Occupancy attack AUC	0.631	0.637	0.646	0.661	0.683
Intel Lab F1 (%)	86.1	86.7	86.4	85.9	85.2
Intel Lab attack AUC	0.646	0.652	0.664	0.681	0.706

shows the complete sweep. Test attack AUC is not part of this rule. The benchmark evaluation uses public calibration mode, so ${ϵ}_{\mathrm{cal}}=0$ and the displayed $ϵ$ is the complete release cost for one invocation. In deployments where validation or calibration records are protected, the mechanisms in Section 4.2 replace direct calibration and the total cost is ${ϵ}_{\mathrm{cal}}+{ϵ}_{\mathrm{rel}}$.

Every result in Table 6,

Table 7. Mean macro-F1 on UCI-HAR and WISDM under different release budgets. Each entry averages ten independent noise draws from the certificate-aware implementation; the largest value in each row is highlighted in bold.

Dataset	$\mathit{ϵ}$	Lap-DP	Gau-DP	Ada-DP	Risk-DP	GC-DP
UCI-HAR	0.2	72.8	73.5	77.6	78.4	82.1
UCI-HAR	0.5	82.7	83.4	86.0	86.8	89.4
UCI-HAR	1.0	86.9	87.4	89.5	90.2	92.3
UCI-HAR	2.0	90.3	90.7	91.8	92.1	93.6
UCI-HAR	4.0	92.4	92.6	93.2	93.5	94.4
WISDM	0.2	54.9	55.6	59.8	60.7	65.2
WISDM	0.5	63.7	64.1	68.6	69.4	72.9
WISDM	1.0	68.4	69.2	72.6	73.5	75.8
WISDM	2.0	72.1	72.8	74.9	75.4	77.1
WISDM	4.0	74.8	75.1	76.4	76.8	78.2

,

Table 8. Mean F1 on Occupancy Detection and Intel Lab Data under different release budgets. Occupancy Detection reports positive-class F1, while Intel Lab Data reports anomaly-oriented F1; each entry averages ten noise draws.

Dataset	$\mathit{ϵ}$	Lap-DP	Gau-DP	Ada-DP	Risk-DP	GC-DP
Occupancy	0.2	83.6	84.4	88.1	89.0	91.7
Occupancy	0.5	89.2	89.9	92.3	92.8	94.2
Occupancy	1.0	93.4	93.8	95.1	95.5	96.4
Occupancy	2.0	95.2	95.6	96.3	96.6	97.2
Occupancy	4.0	96.4	96.7	97.1	97.3	97.8
Intel Lab	0.2	68.7	69.5	73.8	75.1	79.6
Intel Lab	0.5	76.4	77.2	80.9	81.8	84.5
Intel Lab	1.0	81.2	81.9	84.4	85.1	86.7
Intel Lab	2.0	84.8	85.2	87.0	87.5	89.1
Intel Lab	4.0	87.6	88.0	89.5	89.9	91.3

,

Table 9. Mean attribute-inference performance at $ϵ=1.0$ over ten independent privatized releases. Lower oriented AUC and F1 indicate weaker performance for the fixed attacker.

Dataset	Metric	Lap-DP	Gau-DP	Ada-DP	Risk-DP	GC-DP
UCI-HAR	Attack AUC	0.712	0.704	0.681	0.642	0.603
UCI-HAR	Attack F1	0.668	0.661	0.639	0.601	0.568
WISDM	Attack AUC	0.748	0.739	0.711	0.674	0.621
WISDM	Attack F1	0.701	0.693	0.666	0.629	0.581
Occupancy Detection	Attack AUC	0.783	0.775	0.742	0.691	0.637
Occupancy Detection	Attack F1	0.729	0.721	0.697	0.646	0.596
Intel Lab Data	Attack AUC	0.801	0.792	0.756	0.704	0.652
Intel Lab Data	Attack F1	0.744	0.736	0.708	0.661	0.612

,

Table 10. Mean oriented attack AUC under different release budgets. Each entry averages ten independent privatized releases evaluated by the same fixed attacker; lower values indicate weaker attack performance.

Dataset	$\mathit{ϵ}$	Lap-DP	Gau-DP	Ada-DP	Risk-DP	GC-DP
UCI-HAR	0.2	0.641	0.636	0.625	0.602	0.571
UCI-HAR	0.5	0.681	0.674	0.653	0.621	0.589
UCI-HAR	1.0	0.712	0.704	0.681	0.642	0.603
UCI-HAR	2.0	0.746	0.739	0.709	0.668	0.626
UCI-HAR	4.0	0.781	0.774	0.742	0.701	0.661
WISDM	0.2	0.672	0.664	0.648	0.617	0.582
WISDM	0.5	0.713	0.705	0.681	0.644	0.604
WISDM	1.0	0.748	0.739	0.711	0.674	0.621
WISDM	2.0	0.782	0.773	0.744	0.703	0.653
WISDM	4.0	0.817	0.808	0.779	0.738	0.692
Occupancy Detection	0.2	0.704	0.697	0.673	0.629	0.591
Occupancy Detection	0.5	0.747	0.739	0.707	0.659	0.614
Occupancy Detection	1.0	0.783	0.775	0.742	0.691	0.637
Occupancy Detection	2.0	0.821	0.812	0.776	0.724	0.671
Occupancy Detection	4.0	0.856	0.848	0.812	0.761	0.713
Intel Lab Data	0.2	0.719	0.711	0.684	0.641	0.603
Intel Lab Data	0.5	0.763	0.754	0.721	0.674	0.628
Intel Lab Data	1.0	0.801	0.792	0.756	0.704	0.652
Intel Lab Data	2.0	0.838	0.829	0.793	0.741	0.689
Intel Lab Data	4.0	0.872	0.864	0.828	0.779	0.731

,

Table 11. Mean ablation results at $ϵ=1.0$. All variants retain the certified sensitivity floor; F1 and oriented attack AUC are averaged over ten independent noise draws.

Dataset	Metric	w/o Lag	w/o Comp.	w/o Utility	w/o Risk	GC-DP
UCI-HAR	F1 (%)	91.5	90.8	89.7	90.4	92.3
UCI-HAR	Attack AUC	0.621	0.596	0.587	0.641	0.603
WISDM	F1 (%)	74.2	73.6	72.1	73.0	75.8
WISDM	Attack AUC	0.648	0.613	0.602	0.671	0.621
Occupancy Detection	F1 (%)	95.8	95.4	94.1	94.9	96.4
Occupancy Detection	Attack AUC	0.655	0.628	0.614	0.682	0.637
Intel Lab Data	F1 (%)	85.3	84.8	83.6	84.2	86.7
Intel Lab Data	Attack AUC	0.681	0.642	0.631	0.699	0.652

and Table 12 is an empirical measurement from the certificate-aware implementation in Algorithms 1–4. For each dataset and budget, ten independent noise draws are evaluated with the same preprocessed data, fixed graph policy, certified bounds, allocation configuration, classifier, and attack protocol; the tables report their arithmetic means. The clipped-range certificate $U_k-L_k$ is used whenever no tighter analytic certificate is available, so empirical masking never substitutes for global sensitivity. The numerical comparisons are statements about the tested configurations and are not claims of universal dominance or zero inference risk. Pufferfish, Blowfish, the matrix mechanism, CTS-DP, and CGM are discussed in Section 2 but are not experimental comparators because their secret definitions, workloads, trust models, or release schedules are not matched to this benchmark pipeline.

Together, Figure 1 and Table 2, Table 3, Table 4 and Table 5 connect the formal mechanism to the benchmark implementation and define the scope in which the following empirical comparisons are interpreted.

5.2. Overall Utility Under Different Privacy Budgets

Table 7 reports mean macro-F1 for UCI-HAR and WISDM. At $ϵ=1$, GC-DP achieves a UCI-HAR F1 score of $92.3\%$, which is 5.4, 4.9, 2.8, and 2.1 percentage points above Lap-DP, Gau-DP, Ada-DP, and Risk-DP, respectively. Its WISDM mean is $75.8\%$, versus $68.4\%$ and $73.5\%$ for Lap-DP and Risk-DP, respectively. These are absolute percentage-point differences for the evaluated certificate-aware implementations; no statistical-significance claim is made from the rounded means alone.

Table 12. Average runtime and peak process memory for one calibration-and-release pass at $ϵ=1.0$ in the common evaluation environment.

Dataset	Metric	Lap-DP	Ada-DP	Risk-DP	GC-DP	GC-DP-Cache
UCI-HAR	Runtime (s)	0.08	0.19	0.42	0.71	0.24
UCI-HAR	Memory (MB)	18.4	23.7	31.2	35.8	28.6
WISDM	Runtime (s)	0.15	0.36	1.04	2.18	0.69
WISDM	Memory (MB)	24.1	33.5	48.7	57.4	42.9
Occupancy Detection	Runtime (s)	0.04	0.11	0.23	0.39	0.14
Occupancy Detection	Memory (MB)	9.8	13.2	18.5	21.7	16.1
Intel Lab Data	Runtime (s)	0.18	0.41	1.28	2.46	0.77
Intel Lab Data	Memory (MB)	27.6	36.9	52.8	61.3	45.5

Table 12. Average runtime and peak process memory for one calibration-and-release pass at $ϵ=1.0$ in the common evaluation environment.

Dataset	Metric	Lap-DP	Ada-DP	Risk-DP	GC-DP	GC-DP-Cache
UCI-HAR	Runtime (s)	0.08	0.19	0.42	0.71	0.24
UCI-HAR	Memory (MB)	18.4	23.7	31.2	35.8	28.6
WISDM	Runtime (s)	0.15	0.36	1.04	2.18	0.69
WISDM	Memory (MB)	24.1	33.5	48.7	57.4	42.9
Occupancy Detection	Runtime (s)	0.04	0.11	0.23	0.39	0.14
Occupancy Detection	Memory (MB)	9.8	13.2	18.5	21.7	16.1
Intel Lab Data	Runtime (s)	0.18	0.41	1.28	2.46	0.77
Intel Lab Data	Memory (MB)	27.6	36.9	52.8	61.3	45.5

Figure 2 visualizes the UCI-HAR means from Table 7. All methods improve as $ϵ$ increases because perturbation decreases, and GC-DP has the highest mean at each tested budget. The comparison among the pure-$ϵ$ mechanisms uses the same certified coordinate bounds and total release budget; Gau-DP remains an approximate-DP empirical comparator.

Table 8 gives mean F1 for Occupancy Detection and Intel Lab Data. At $ϵ=0.5$, GC-DP reaches 94.2%, 5.0 percentage points above Lap-DP. For Intel Lab Data, GC-DP achieves 86.7% at $ϵ=1$ and 91.3% at $ϵ=4$. Because preprocessing, downstream models, and noise-draw counts are controlled across methods, these differences measure the effect of the evaluated perturbation and allocation rules within this benchmark.

Figure 3 reports Intel Lab aggregate normalized mean absolute error. At $ϵ=1$, the means are $0.063$ for GC-DP and $0.114$ for Lap-DP. Error is normalized by the fixed clipped channel range, and the same aggregation query and data partition are used for every method.

Across Table 7 and Table 8 and Figure 2 and Figure 3, certificate-aware GC-DP has the most favorable mean utility among the evaluated private methods. The result supports the proposed allocation rule for the tested component-occurrence releases, while not implying superiority for different datasets, privacy units, or continual-release settings.

5.3. Privacy Leakage and Correlation Robustness Analysis

The attribute-inference evaluation is distinct from the formal DP adversary. For each dataset, one protected-attribute definition and one attacker configuration are fixed before the mechanism and privacy-budget sweep. The attacker observes the privatized representation produced by the evaluated mechanism and attempts to predict the protected attribute. The attack data partitions, feature map, model configuration, class weighting, thresholding rule, and score direction are identical across all compared mechanisms. AUC is oriented so that values above 0.5 denote better-than-random prediction; because an attacker may invert its score, the effective AUC is interpreted as $\max \{\mathrm{AUC},1-\mathrm{AUC}\}$ [33,34]. Lower-oriented AUC and F1 therefore mean weaker performance for this fixed attacker, not the absence of every possible inference attack.

Table 9 reports mean performance of the fixed attacker at $ϵ=1$. GC-DP is lowest among the evaluated methods: its AUC is 0.603, 0.621, 0.637, and 0.652 on UCI-HAR, WISDM, Occupancy, and Intel Lab, respectively. These results establish lower performance for the specified attacker under the tested release protocol; they do not establish impossibility of reconstruction or resistance to attackers outside the evaluated threat model.

Table 10 gives the mean oriented attack AUCs across release budgets. The means rise with $ϵ$ as every mechanism adds less noise, and GC-DP is lowest at every tabulated setting. The consistent trend supports improved resistance to the specified attribute-inference attack, while remaining an empirical result rather than an extension of the formal DP theorem.

Figure 4 visualizes the Occupancy and Intel Lab means in Table 10. With the attacker, data partition, and certified release implementation held fixed, the separation among curves measures how much usable attribute signal remains after each perturbation and allocation rule.

The sparsification threshold $\tau$ is selected by validation F1 at $ϵ=1$ from the displayed grid. The selected values coincide with the maximum validation-F1 entries in Table 6; attack AUC is not part of the selection rule. Ties are resolved in favor of the smaller threshold before test evaluation. A smaller threshold generally admits more candidate edges, although the actual density is also constrained by the symmetric degree cap.

Figure 5 plots the WISDM and Intel Lab test F1 and oriented attack AUC obtained after applying each candidate $\tau$ in the fixed pipeline. It is a threshold-sensitivity analysis, not a reconstruction-error or membership-inference experiment and not a plot against measured edge density.

Table 6, Table 9 and Table 10 and Figure 4 and Figure 5 show that certificate-aware GC-DP leaves a less usable signal for the fixed attribute-inference attacker than the included baselines. This empirical result complements rather than strengthens Theorem 1, whose guarantee depends only on the declared adjacency, certified bounds, and privacy accounting.

5.4. Ablation, Runtime, and Edge Feasibility Analysis

Table 11 reports four component removals at $ϵ=1$. Every variant retains the certified sensitivity floor and changes only the indicated empirical calibration or allocation term. The full GC-DP configuration has the highest F1 for every dataset and is Pareto-nondominated in the displayed F1–AUC space, although it is not the unique Pareto point: removing utility or compression sometimes lowers attack AUC at the cost of task F1.

Figure 6 makes the Pareto interpretation explicit. Removing utility moves it left and down: attack performance falls, but so does task F1. Removing graph exposure raises attack AUC and lowers F1. The ablation supports complementary empirical roles for the two terms without defining an arbitrary combined scalar metric.

Graph construction dominates the $O\left(M^2(2L+1)N_{\mathrm{cal}}\right)$ calibration cost; allocation and release are linear in d. Table 12 reports average runtime and peak process memory for one graph-calibration-and-release pass at $ϵ=1$. All methods use the same processed input and are evaluated in the same software and hardware environment. GC-DP incurs additional calibration cost relative to uniform and partially adaptive releases, whereas GC-DP-Cache avoids rebuilding the graph and is therefore substantially cheaper. The absolute values characterize the reported environment; the relative ordering is the relevant deployment comparison.

GC-DP-Cache reuses $\theta$ before release. Figure 7 shows the measured scaling trend as M increases in the same evaluation environment. Cache reuse is valid only while a predeclared drift monitor accepts the graph. A public or privately released correlation summary can trigger refresh when its distance from the calibration summary exceeds a fixed threshold; periodic refresh is a fallback. Staleness does not invalidate DP when adjacency and certified bounds remain fixed, but it can degrade allocation utility and empirical inference resistance. Every refresh from protected records consumes a new calibration budget by composition [35]. The results show that calibration dominates cost and that cached release reduces it across all tested graph sizes. Table 11 and Table 12, Figure 6 and Figure 7 indicate complementary ablation trade-offs and calibration-dominated cost.

5.5. Limitations and Scope

GC-DP has five principal limitations. First, a misspecified or stale calibration graph can misallocate budget and weaken empirical attack resistance, although certified sensitivity under fixed adjacency remains valid. Second, the universal private-graph sensitivity bound ${\mathrm{\Delta }}_{1}S\le P$ can add substantial calibration noise; the benchmark results use public calibration and therefore do not quantify that private-calibration utility cost. Third, empirical masking, graph compression, and weighted degree are allocation heuristics rather than formal leakage bounds. Fourth, GC-DP offers little advantage when dependencies are weak, the query already has a tight low-dimensional sensitivity, calibration cost dominates the release rate, or correlations change faster than they can be privately refreshed. Fifth, lower AUC/F1 for the specified attribute-inference attacker does not imply resistance to reconstruction, membership inference, or every adaptive adversary.

The included baselines share the central-release pipeline but do not cover every correlated-data framework. Pufferfish and Blowfish require a secret/policy specification; the matrix mechanism requires a linear workload; CTS-DP assumes time-series publication; and CGM uses $(ϵ,\delta )$-local DP. Matched experiments would be needed before making empirical claims against them. Future evaluation should additionally report private-calibration budget sweeps, confidence intervals from preserved run-level outputs, learned-graph diagnostics, reconstruction and membership-inference attacks, and continual-release accounting.

6. Conclusions

GC-DP combines a lag-aware calibration graph with certified coordinatewise sensitivity and task-aware budget allocation. Its formal guarantee is ${ϵ}_{\mathrm{rel}}$-DP for a fixed graph-expanded adjacency when every $s_k$ upper-bounds true sensitivity; calibrating parameters from the same protected records adds the explicitly composed cost ${ϵ}_{\mathrm{cal}}$. Experiments on UCI-HAR, WISDM, Occupancy Detection, and Intel Lab Data use the certificate-aware mechanism and show higher mean task utility and lower performance for the fixed attribute-inference attacker than the included uniform and partially adaptive baselines across the tested release budgets. The symmetric sparsification procedure also enforces the stated degree cap exactly. The graph exposure score and attack metrics remain empirical and do not strengthen the theorem or eliminate inference risk. Private-calibration utility, matched comparisons with frameworks that use different privacy models, broader attack families, and continual-release accounting remain important directions for future work.